Merge branch '3.9-dev' of github.com:joomla/joomla-cms into dev/privacy

.gitignore

@@ -150,6 +150,8 @@ Desktop.ini
 /libraries/vendor/symfony/polyfill-php55/README.md
 /libraries/vendor/symfony/polyfill-php56/composer.json
 /libraries/vendor/symfony/polyfill-php56/README.md
+/libraries/vendor/symfony/polyfill-php73/composer.json
+/libraries/vendor/symfony/polyfill-php73/README.md
 /libraries/vendor/symfony/polyfill-util/composer.json
 /libraries/vendor/symfony/polyfill-util/README.md
 /libraries/vendor/symfony/polyfill-util/TestListener.php

administrator/components/com_admin/postinstall/updatedefaultsettings.php

@@ -0,0 +1,27 @@
+<?php
+/**
+ * @package     Joomla.Administrator
+ * @subpackage  com_admin
+ *
+ * @copyright   Copyright (C) 2005 - 2018 Open Source Matters, Inc. All rights reserved.
+ * @license     GNU General Public License version 2 or later; see LICENSE.txt
+ *
+ * This file contains post-installation message handling for notifying users of a change
+ * in various default settings.
+ */
+
+defined('_JEXEC') or die;
+
+/**
+ * Notifies users of a change in various default settings
+ *
+ * This check returns true regardless of condition.
+ *
+ * @return  boolean
+ *
+ * @since   3.8.8
+ */
+function admin_postinstall_updatedefaultsettings_condition()
+{
+	return true;
+}

administrator/components/com_admin/script.php

@@ -810,6 +810,17 @@ public function deleteUnexistingFiles()
 			'/media/plg_quickicon_extensionupdate/extensionupdatecheck.js',
 			'/media/plg_quickicon_joomlaupdate/jupdatecheck.js',
 			// Joomla! 3.1
+			'/libraries/cms/feed/entry.php',
+			'/libraries/cms/feed/factory.php',
+			'/libraries/cms/feed/feed.php',
+			'/libraries/cms/feed/link.php',
+			'/libraries/cms/feed/parser.php',
+			'/libraries/cms/feed/parser/atom.php',
+			'/libraries/cms/feed/parser/namespace.php',
+			'/libraries/cms/feed/parser/rss.php',
+			'/libraries/cms/feed/parser/rss/itunes.php',
+			'/libraries/cms/feed/parser/rss/media.php',
+			'/libraries/cms/feed/person.php',
 			'/libraries/joomla/application/router.php',
 			'/libraries/joomla/form/rules/boolean.php',
 			'/libraries/joomla/form/rules/color.php',
@@ -2037,6 +2048,9 @@ public function deleteUnexistingFiles()
 			'/libraries/joomla/image/filters',
 			'/libraries/joomla/log/loggers',
 			// Joomla! 3.1
+			'/libraries/cms/feed/parser/rss',
+			'/libraries/cms/feed/parser',
+			'/libraries/cms/feed',
 			'/libraries/joomla/form/rules',
 			'/libraries/joomla/html/language/en-GB',
 			'/libraries/joomla/html/language',

administrator/components/com_admin/sql/updates/mysql/3.8.8-2018-05-18.sql

@@ -0,0 +1,3 @@
+INSERT INTO `#__postinstall_messages` (`extension_id`, `title_key`, `description_key`, `action_key`, `language_extension`, `language_client_id`, `type`, `action_file`, `action`, `condition_file`, `condition_method`, `version_introduced`, `enabled`)
+VALUES
+(700, 'COM_CPANEL_MSG_UPDATEDEFAULTSETTINGS_TITLE', 'COM_CPANEL_MSG_UPDATEDEFAULTSETTINGS_BODY', '', 'com_cpanel', 1, 'message', '', '', 'admin://components/com_admin/postinstall/updatedefaultsettings.php', 'admin_postinstall_updatedefaultsettings_condition', '3.8.8', 1);

administrator/components/com_admin/sql/updates/postgresql/3.8.8-2018-05-18.sql

@@ -0,0 +1,3 @@
+INSERT INTO "#__postinstall_messages" ("extension_id", "title_key", "description_key", "action_key", "language_extension", "language_client_id", "type", "action_file", "action", "condition_file", "condition_method", "version_introduced", "enabled")
+VALUES
+(700, 'COM_CPANEL_MSG_UPDATEDEFAULTSETTINGS_TITLE', 'COM_CPANEL_MSG_UPDATEDEFAULTSETTINGS_BODY', '', 'com_cpanel', 1, 'message', '', '', 'admin://components/com_admin/postinstall/updatedefaultsettings.php', 'admin_postinstall_updatedefaultsettings_condition', '3.8.8', 1);

administrator/components/com_admin/sql/updates/sqlazure/3.8.8-2018-05-18.sql

@@ -0,0 +1,2 @@
+INSERT INTO [#__postinstall_messages] ([extension_id], [title_key], [description_key], [action_key], [language_extension], [language_client_id], [type], [action_file], [action], [condition_file], [condition_method], [version_introduced], [enabled])
+SELECT 700, 'COM_CPANEL_MSG_UPDATEDEFAULTSETTINGS_TITLE', 'COM_CPANEL_MSG_UPDATEDEFAULTSETTINGS_BODY', '', 'com_cpanel', 1, 'message', '', '', 'admin://components/com_admin/postinstall/updatedefaultsettings.php', 'admin_postinstall_updatedefaultsettings_condition', '3.8.8', 1;

administrator/components/com_banners/helpers/banners.php

@@ -188,7 +188,7 @@ public static function getClientOptions()
 	/**
 	 * Adds Count Items for Category Manager.
 	 *
-	 * @param   stdClass[]  &$items  The banner category objects
+	 * @param   stdClass[]  $items  The banner category objects
 	 *
 	 * @return  stdClass[]
 	 *
@@ -242,7 +242,7 @@ public static function countItems(&$items)
 	/**
 	 * Adds Count Items for Tag Manager.
 	 *
-	 * @param   stdClass[]  &$items     The banner tag objects
+	 * @param   stdClass[]  $items      The banner tag objects
 	 * @param   string      $extension  The name of the active view.
 	 *
 	 * @return  stdClass[]

administrator/components/com_banners/models/banner.php

@@ -373,7 +373,7 @@ protected function loadFormData()
 	/**
 	 * Method to stick records.
 	 *
-	 * @param   array    &$pks   The ids of the items to publish.
+	 * @param   array    $pks    The ids of the items to publish.
 	 * @param   integer  $value  The value of the published state
 	 *
 	 * @return  boolean  True on success.

administrator/components/com_banners/tables/banner.php

@@ -22,7 +22,7 @@ class BannersTableBanner extends JTable
 	/**
 	 * Constructor
 	 *
-	 * @param   JDatabaseDriver  &$db  Database connector object
+	 * @param   JDatabaseDriver  $db  Database connector object
 	 *
 	 * @since   1.5
 	 */

administrator/components/com_banners/tables/client.php

@@ -21,7 +21,7 @@ class BannersTableClient extends JTable
 	/**
 	 * Constructor
 	 *
-	 * @param   JDatabaseDriver  &$db  Database connector object
+	 * @param   JDatabaseDriver  $db  Database connector object
 	 *
 	 * @since   1.5
 	 */

administrator/components/com_categories/controllers/categories.php

@@ -68,7 +68,7 @@ public function rebuild()
 	/**
 	 * Save the manual order inputs from the categories list page.
 	 *
-	 * @return      void
+	 * @return      boolean  True on success
 	 *
 	 * @since       1.6
 	 * @see         JControllerAdmin::saveorder()

administrator/components/com_categories/models/categories.php

@@ -366,7 +366,7 @@ public function getItems()
 	/**
 	 * Method to load the countItems method from the extensions
 	 *
-	 * @param   stdClass[]  &$items     The category items
+	 * @param   stdClass[]  $items      The category items
 	 * @param   string      $extension  The category extension
 	 *
 	 * @return  void

administrator/components/com_categories/models/category.php

@@ -359,7 +359,7 @@ protected function loadFormData()
 	 * @param   mixed   $data   The data expected for the form.
 	 * @param   string  $group  The name of the plugin group to import.
 	 *
-	 * @return  void
+	 * @return  mixed
 	 *
 	 * @see     JFormField
 	 * @since   1.6
@@ -695,7 +695,7 @@ public function save($data)
 	/**
 	 * Method to change the published state of one or more records.
 	 *
-	 * @param   array    &$pks   A list of the primary keys to change.
+	 * @param   array    $pks    A list of the primary keys to change.
 	 * @param   integer  $value  The value of the published state.
 	 *
 	 * @return  boolean  True on success.

administrator/components/com_contact/helpers/contact.php

@@ -57,7 +57,7 @@ public static function addSubmenu($vName)
 	/**
 	 * Adds Count Items for Category Manager.
 	 *
-	 * @param   stdClass[]  &$items  The contact category objects
+	 * @param   stdClass[]  $items  The contact category objects
 	 *
 	 * @return  stdClass[]
 	 *
@@ -111,7 +111,7 @@ public static function countItems(&$items)
 	/**
 	 * Adds Count Items for Tag Manager.
 	 *
-	 * @param   stdClass[]  &$items     The banner tag objects
+	 * @param   stdClass[]  $items      The banner tag objects
 	 * @param   string      $extension  The name of the active view.
 	 *
 	 * @return  stdClass[]

administrator/components/com_contact/tables/contact.php

@@ -30,7 +30,7 @@ class ContactTableContact extends JTable
 	/**
 	 * Constructor
 	 *
-	 * @param   JDatabaseDriver  &$db  Database connector object
+	 * @param   JDatabaseDriver  $db  Database connector object
 	 *
 	 * @since   1.0
 	 */

administrator/components/com_content/helpers/content.php

@@ -91,7 +91,7 @@ public static function filterText($text)
 	/**
 	 * Adds Count Items for Category Manager.
 	 *
-	 * @param   stdClass[]  &$items  The banner category objects
+	 * @param   stdClass[]  $items  The banner category objects
 	 *
 	 * @return  stdClass[]
 	 *
@@ -145,7 +145,7 @@ public static function countItems(&$items)
 	/**
 	 * Adds Count Items for Tag Manager.
 	 *
-	 * @param   stdClass[]  &$items     The content objects
+	 * @param   stdClass[]  $items      The content objects
 	 * @param   string      $extension  The name of the active view.
 	 *
 	 * @return  stdClass[]

administrator/components/com_content/models/article.php

@@ -970,7 +970,7 @@ private function canCreateCategory()
 	/**
 	 * Delete #__content_frontpage items if the deleted articles was featured
 	 *
-	 * @param   object  &$pks  The primary key related to the contents that was deleted.
+	 * @param   object  $pks  The primary key related to the contents that was deleted.
 	 *
 	 * @return  boolean
 	 *

administrator/components/com_content/tables/featured.php

@@ -19,7 +19,7 @@ class ContentTableFeatured extends JTable
 	/**
 	 * Constructor
 	 *
-	 * @param   JDatabaseDriver  &$db  Database connector object
+	 * @param   JDatabaseDriver  $db  Database connector object
 	 *
 	 * @since   1.6
 	 */

administrator/components/com_contenthistory/models/history.php

@@ -104,7 +104,7 @@ protected function canDelete($record)
 	/**
 	 * Method to delete one or more records from content history table.
 	 *
-	 * @param   array  &$pks  An array of record primary keys.
+	 * @param   array  $pks  An array of record primary keys.
 	 *
 	 * @return  boolean  True if successful, false if an error occurs.
 	 *
@@ -243,7 +243,7 @@ public function getTable($type = 'Contenthistory', $prefix = 'JTable', $config =
 	/**
 	 * Method to toggle on and off the keep forever value for one or more records from content history table.
 	 *
-	 * @param   array  &$pks  An array of record primary keys.
+	 * @param   array  $pks  An array of record primary keys.
 	 *
 	 * @return  boolean  True if successful, false if an error occurs.
 	 *

administrator/components/com_fields/helpers/fields.php

@@ -591,7 +591,7 @@ public static function displayFieldOnForm($field)
 	/**
 	 * Adds Count Items for Category Manager.
 	 *
-	 * @param   stdClass[]  &$items  The field category objects
+	 * @param   stdClass[]  $items  The field category objects
 	 *
 	 * @return  stdClass[]
 	 *

administrator/components/com_fields/models/field.php

@@ -433,7 +433,7 @@ protected function generateNewTitle($category_id, $name, $title)
 	/**
 	 * Method to delete one or more records.
 	 *
-	 * @param   array  &$pks  An array of record primary keys.
+	 * @param   array  $pks  An array of record primary keys.
 	 *
 	 * @return  boolean  True if successful, false if an error occurs.
 	 *

administrator/components/com_finder/helpers/indexer/indexer.php

@@ -307,8 +307,10 @@ public function remove($linkId)
 			// Update the link counts for the terms.
 			$query->clear()
 				->update($db->quoteName('#__finder_terms', 't'))
-				->join('INNER', $db->quoteName('#__finder_links_terms' . dechex($i), 'm') . ' ON m.term_id = t.term_id')
-				->set('t.links = t.links - 1')
+				->join('INNER', $db->quoteName('#__finder_links_terms' . dechex($i), 'm') .
+					' ON ' . $db->quoteName('m.term_id') . ' = ' . $db->quoteName('t.term_id')
+				)
+				->set($db->quoteName('links') . ' = ' . $db->quoteName('links') . ' - 1')
 				->where($db->quoteName('m.link_id') . ' = ' . (int) $linkId);
 			$db->setQuery($query)->execute();
 

administrator/components/com_media/views/images/tmpl/default.php

@@ -91,7 +91,7 @@
 			</div>
 		</div>
 
-		<iframe id="imageframe" name="imageframe" src="index.php?option=com_media&amp;view=imagesList&amp;tmpl=component&amp;folder=<?php echo $this->state->folder; ?>&amp;asset=<?php echo $asset; ?>&amp;author=<?php echo $author; ?>"></iframe>
+		<iframe id="imageframe" name="imageframe" src="index.php?option=com_media&amp;view=imagesList&amp;tmpl=component&amp;folder=<?php echo rawurlencode($this->state->folder); ?>&amp;asset=<?php echo $asset; ?>&amp;author=<?php echo $author; ?>"></iframe>
 
 		<div class="well">
 			<div class="row-fluid">

administrator/components/com_media/views/imageslist/tmpl/default_folder.php

@@ -12,12 +12,12 @@
 $input = JFactory::getApplication()->input;
 ?>
 <li class="imgOutline thumbnail height-80 width-80 center">
-	<a href="index.php?option=com_media&amp;view=imagesList&amp;tmpl=component&amp;folder=<?php echo $this->_tmp_folder->path_relative; ?>&amp;asset=<?php echo $input->getCmd('asset'); ?>&amp;author=<?php echo $input->getCmd('author'); ?>" target="imageframe">
+	<a href="index.php?option=com_media&amp;view=imagesList&amp;tmpl=component&amp;folder=<?php echo rawurlencode($this->_tmp_folder->path_relative); ?>&amp;asset=<?php echo $input->getCmd('asset'); ?>&amp;author=<?php echo $input->getCmd('author'); ?>" target="imageframe">
 		<div class="height-50">
 			<span class="icon-folder-2"></span>
 		</div>
 		<div class="small">
-			<?php echo JHtml::_('string.truncate', $this->_tmp_folder->name, 10, false); ?>
+			<?php echo JHtml::_('string.truncate', $this->escape($this->_tmp_folder->name), 10, false); ?>
 		</div>
 	</a>
 </li>

administrator/components/com_media/views/imageslist/tmpl/default_image.php

@@ -17,12 +17,12 @@
 ?>
 
 <li class="imgOutline thumbnail height-80 width-80 center">
-	<a class="img-preview" href="javascript:ImageManager.populateFields('<?php echo $this->_tmp_img->path_relative; ?>')" title="<?php echo $this->_tmp_img->name; ?>" >
+	<a class="img-preview" href="javascript:ImageManager.populateFields('<?php echo $this->escape($this->_tmp_img->path_relative); ?>')" title="<?php echo $this->escape($this->_tmp_img->name); ?>" >
 		<div class="height-50">
-			<?php echo JHtml::_('image', $this->baseURL . '/' . $this->_tmp_img->path_relative, JText::sprintf('COM_MEDIA_IMAGE_TITLE', $this->_tmp_img->title, JHtml::_('number.bytes', $this->_tmp_img->size)), array('width' => $this->_tmp_img->width_60, 'height' => $this->_tmp_img->height_60)); ?>
+			<?php echo JHtml::_('image', $this->baseURL . '/' . $this->escape($this->_tmp_img->path_relative), JText::sprintf('COM_MEDIA_IMAGE_TITLE', $this->escape($this->_tmp_img->title), JHtml::_('number.bytes', $this->_tmp_img->size)), array('width' => $this->_tmp_img->width_60, 'height' => $this->_tmp_img->height_60)); ?>
 		</div>
 		<div class="small">
-			<?php echo JHtml::_('string.truncate', $this->_tmp_img->name, 10, false); ?>
+			<?php echo JHtml::_('string.truncate', $this->escape($this->_tmp_img->name), 10, false); ?>
 		</div>
 	</a>
 </li>

administrator/components/com_media/views/media/tmpl/default.php

@@ -77,7 +77,7 @@
 		<form action="index.php?option=com_media" name="adminForm" id="mediamanager-form" method="post" enctype="multipart/form-data" >
 			<input type="hidden" name="task" value="" />
 			<input type="hidden" name="cb1" id="cb1" value="0" />
-			<input class="update-folder" type="hidden" name="folder" id="folder" value="<?php echo $this->state->folder; ?>" />
+			<input class="update-folder" type="hidden" name="folder" id="folder" value="<?php echo $this->escape($this->state->folder); ?>" />
 		</form>
 
 		<?php if ($user->authorise('core.create', 'com_media')) : ?>
@@ -94,7 +94,7 @@
 								<?php echo JText::sprintf('JGLOBAL_MAXIMUM_UPLOAD_SIZE_LIMIT', JHtml::_('number.bytes', $maxSize)); ?>
 							</p>
 					</fieldset>
-					<input class="update-folder" type="hidden" name="folder" id="folder" value="<?php echo $this->state->folder; ?>" />
+					<input class="update-folder" type="hidden" name="folder" id="folder" value="<?php echo $this->escape($this->state->folder); ?>" />
 					<?php JFactory::getSession()->set('com_media.return_url', 'index.php?option=com_media'); ?>
 				</div>
 			</form>
@@ -104,7 +104,7 @@
 					<div class="path">
 						<input type="text" id="folderpath" readonly="readonly" class="update-folder" />
 						<input required type="text" id="foldername" name="foldername" />
-						<input class="update-folder" type="hidden" name="folderbase" id="folderbase" value="<?php echo $this->state->folder; ?>" />
+						<input class="update-folder" type="hidden" name="folderbase" id="folderbase" value="<?php echo $this->escape($this->state->folder); ?>" />
 						<button type="submit" class="btn"><span class="icon-folder-open"></span> <?php echo JText::_('COM_MEDIA_CREATE_FOLDER'); ?></button>
 					</div>
 					<?php echo JHtml::_('form.token'); ?>
@@ -115,7 +115,7 @@
 		<form action="index.php?option=com_media&amp;task=folder.create&amp;tmpl=<?php echo $input->getCmd('tmpl', 'index'); ?>" name="folderForm" id="folderForm" method="post">
 			<div id="folderview">
 				<div class="view">
-					<iframe class="thumbnail" src="index.php?option=com_media&amp;view=mediaList&amp;tmpl=component&amp;folder=<?php echo $this->state->folder; ?>" id="folderframe" name="folderframe" width="100%" height="500px" marginwidth="0" marginheight="0" scrolling="auto"></iframe>
+					<iframe class="thumbnail" src="index.php?option=com_media&amp;view=mediaList&amp;tmpl=component&amp;folder=<?php echo $this->escape($this->state->folder); ?>" id="folderframe" name="folderframe" width="100%" height="500px" marginwidth="0" marginheight="0" scrolling="auto"></iframe>
 				</div>
 				<?php echo JHtml::_('form.token'); ?>
 			</div>

administrator/components/com_media/views/media/tmpl/default_folders.php

@@ -19,9 +19,9 @@
 	// Get a sanitised name for the target
 	$target = str_replace('/', '-', $folder['data']->relative); ?>
 	<li id="<?php echo $target; ?>" class="folder">
-		<a href="index.php?option=com_media&amp;view=mediaList&amp;tmpl=component&amp;folder=<?php echo $folder['data']->relative; ?>" target="folderframe" class="folder-url" >
+		<a href="index.php?option=com_media&amp;view=mediaList&amp;tmpl=component&amp;folder=<?php echo rawurlencode($folder['data']->relative); ?>" target="folderframe" class="folder-url" >
 			<span class="icon-folder"></span>
-			<?php echo $folder['data']->name; ?>
+			<?php echo $this->escape($folder['data']->name); ?>
 		</a>
 		<?php echo $this->getFolderLevel($folder); ?>
 	</li>

administrator/components/com_media/views/medialist/tmpl/details.php

@@ -81,13 +81,13 @@
 	"
 );
 ?>
-<form target="_parent" action="index.php?option=com_media&amp;tmpl=index&amp;folder=<?php echo $this->state->folder; ?>" method="post" id="mediamanager-form" name="mediamanager-form">
+<form target="_parent" action="index.php?option=com_media&amp;tmpl=index&amp;folder=<?php echo rawurlencode($this->state->folder); ?>" method="post" id="mediamanager-form" name="mediamanager-form">
 	<div class="muted">
 		<p>
 			<span class="icon-folder"></span>
 			<?php
 				echo $params->get($path, 'images'),
-					($this->state->folder != '') ? '/' . $this->state->folder : '';
+					($this->escape($this->state->folder) != '') ? '/' . $this->escape($this->state->folder) : '';
 			?>
 		</p>
 	</div>

administrator/components/com_media/views/medialist/tmpl/details_doc.php

@@ -20,11 +20,11 @@
 
 <tr>
 	<td>
-		<a  title="<?php echo $this->_tmp_doc->name; ?>">
-			<?php  echo JHtml::_('image', $this->_tmp_doc->icon_16, $this->_tmp_doc->title, null, true, true) ? JHtml::_('image', $this->_tmp_doc->icon_16, $this->_tmp_doc->title, array('width' => 16, 'height' => 16), true) : JHtml::_('image', 'media/con_info.png', $this->_tmp_doc->title, array('width' => 16, 'height' => 16), true);?> </a>
+		<a  title="<?php echo $this->escape($this->_tmp_doc->name); ?>">
+			<?php  echo JHtml::_('image', $this->_tmp_doc->icon_16, $this->escape($this->_tmp_doc->title), null, true, true) ? JHtml::_('image', $this->_tmp_doc->icon_16, $this->_tmp_doc->title, array('width' => 16, 'height' => 16), true) : JHtml::_('image', 'media/con_info.png', $this->escape($this->_tmp_doc->title), array('width' => 16, 'height' => 16), true);?> </a>
 	</td>
-	<td class="description"  title="<?php echo $this->_tmp_doc->name; ?>">
-		<?php echo $this->_tmp_doc->title; ?>
+	<td class="description"  title="<?php echo $this->escape($this->_tmp_doc->name); ?>">
+		<?php echo $this->escape($this->_tmp_doc->title); ?>
 	</td>
 	<td>&#160;
 
@@ -34,8 +34,8 @@
 	</td>
 <?php if ($user->authorise('core.delete', 'com_media')):?>
 	<td>
-		<a class="delete-item" target="_top" href="index.php?option=com_media&amp;task=file.delete&amp;tmpl=index&amp;<?php echo JSession::getFormToken(); ?>=1&amp;folder=<?php echo $this->state->folder; ?>&amp;rm[]=<?php echo $this->_tmp_doc->name; ?>" rel="<?php echo $this->_tmp_doc->name; ?>"><span class="icon-remove hasTooltip" title="<?php echo JHtml::_('tooltipText', 'JACTION_DELETE');?>"></span></a>
-		<input type="checkbox" name="rm[]" value="<?php echo $this->_tmp_doc->name; ?>" />
+		<a class="delete-item" target="_top" href="index.php?option=com_media&amp;task=file.delete&amp;tmpl=index&amp;<?php echo JSession::getFormToken(); ?>=1&amp;folder=<?php echo rawurlencode($this->state->folder); ?>&amp;rm[]=<?php echo $this->escape($this->_tmp_doc->name); ?>" rel="<?php echo $this->escape($this->_tmp_doc->name); ?>"><span class="icon-remove hasTooltip" title="<?php echo JHtml::_('tooltipText', 'JACTION_DELETE');?>"></span></a>
+		<input type="checkbox" name="rm[]" value="<?php echo $this->escape($this->_tmp_doc->name); ?>" />
 	</td>
 <?php endif;?>
 </tr>